Moderate: python3 security update
Summary
ALSA-2024:4243: Moderate: python3 security update. Affects python3.12 versions < 3.12.3-2.el8_10. Fixed in 3.12.3-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The zipfile module in Python is vulnerable to zip-bombs, which can lead to denial of service. This vulnerability is identified as CVE-2024-0450. A zip-bomb is a malicious archive file that is designed to consume excessive system resources when extracted. An attacker can craft a zip-bomb that, when processed by the zipfile module, can cause the Python process to consume excessive CPU and memory resources, leading to a denial of service condition.
How To Fix
Minimum fixed version
3.12.3-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security update as soon as possible.
Conclusion
The Python zipfile module is vulnerable to zip-bombs, which can lead to a denial of service condition. It is important to update the Python package to the latest version to mitigate this vulnerability.
See every vulnerability recorded for python3.12 →
FAQ
A zip-bomb is a malicious archive file that is designed to consume excessive system resources when extracted.
The vulnerability can lead to a denial of service condition, where the Python process consumes excessive CPU and memory resources.
You can use the Vulert Playground at Vulert Scanner to check if your Python installation is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities.
There are no known exploits for this vulnerability at the moment.
No, there is no known workaround for this vulnerability. It is recommended to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
